How do I run comments and reviews on my website safely?
Comments, reviews, forums and photo uploads can bring customers back and build trust. They also mean strangers can publish on your website, under your name. In Australia that can make you responsible for what they post. A few settings and a clear moderation routine take most of the risk out. If you'd rather have it checked, our website security and compliance audit lists every place on your site where visitors can post or upload.
Last updated
The short answer
In Fairfax Media Publications v Voller [2021] HCA 27, the High Court held that businesses which run a public page and invite comments can be publishers of the comments other people leave. So a business that hosts comments, reviews or a forum should moderate them, block spam and remove unlawful posts quickly. Under the Australian Consumer Law, as explained by the ACCC, a business must not post or arrange fake reviews, must not hide or remove genuine negative reviews, and should display its policy for publishing, editing and removing reviews. This page is general information, not legal advice.
Why comments on your site are your problem
In Voller, three media companies ran public Facebook pages and posted news stories that drew comments about Dylan Voller. The High Court found that by facilitating, encouraging and thereby assisting those comments, the companies were publishers of them. The judgment also refers to earlier cases where the hosts of online forums were treated as publishers of their members' posts. The case decided who is a publisher. It didn't decide whether the comments were defamatory or whether a defence applied, but it means the owner of a page that invites comments can't assume the person who typed the comment is the only one at risk.
What to set up before you open comments or reviews
Pre-moderation for anything public
Hold new comments, reviews and uploads in a queue until someone approves them. This is the safest choice for most small business sites.
Post-moderation, if you must
Posts go live straight away and you review them after. Only use it if someone checks the site every day and can remove posts fast.
Word filters
Hold or block posts with names, slurs, links or phone numbers. Filters catch the obvious ones, so a person still needs to read the queue.
Spam protection
Add a CAPTCHA or an anti-spam service to every form that publishes something. Spam bots fill unprotected comment boxes with links to scam sites.
A report button
Let visitors flag a post, and send those reports to an inbox someone reads.
A published review policy
Say what you publish, what you edit and what you remove, and stick to it. The ACCC says businesses and review platforms should display this policy clearly.
Uploads kept private by default
Photos and files from visitors should go to you, not straight onto a public page. Check them before anything is shown.
Where this applies
- Blogs and news pages with a comment section.
- Online shops and service sites that show customer reviews or star ratings.
- Member areas, forums and community boards.
- Sites where customers upload photos, files or before and after pictures that others can see.
- Old WordPress sites where comments were switched on years ago and nobody has looked since.
A simple moderation routine
- Turn off what you don't use. Close comments on old posts and remove forum or review plugins nobody uses. Fewer open forms also means fewer ways for attackers and spammers to get in.
- Hold new posts for approval. Switch on pre-moderation, add a word filter and put spam protection on every public form.
- Name someone to check the queue. Set how often they check. Give them a short list of what to remove: abuse, threats, personal details, false claims about real people, and spam.
- Act fast on complaints. When someone says a post is untrue or abusive, hide it while you look into it. Keep a copy of the post, the complaint and what you did.
- Treat reviews fairly. Publish genuine reviews whether they're good or bad. Remove a review only when you have an adequate basis to think it's fake or misleading, or it breaks your published policy.
How WaTo can help
- Our website security and compliance audit finds every comment box, review widget, forum and upload form on your site, including ones left behind by old plugins.
- We can set up moderation queues, word filters, spam protection and report buttons, then keep them updated through website maintenance.
- A web application firewall stops a lot of bot traffic before it reaches your forms.
- We're not lawyers. If someone threatens legal action over a post or review, talk to a defamation lawyer.
Comments and reviews questions
Am I responsible for comments people leave on my website?
You can be. In the Voller case the High Court held that businesses which invite comments on a page they run can be publishers of those comments. Moderating posts before they go live, and removing problem posts quickly, lowers that risk.
Can I delete negative reviews from my website?
You can remove reviews that are fake, abusive or off topic, but not a genuine review because it's negative. The ACCC says suppressing, editing or removing genuine negative reviews can mislead consumers. You can remove a review you have an adequate basis to think is fake or misleading, or one that breaks your published review policy, such as abuse or personal details.
Can I offer a discount for leaving a review?
Only if you give it whether the review is good or bad, and you clearly disclose that the review was incentivised. Reviews by staff, family or anyone paid by the business also need that connection stated.
Someone left a fake review about us on Google. What can we do?
The ACCC suggests asking the review platform to remove it, or replying to correct the record. eSafety won't help with this one: its adult cyber abuse scheme isn't meant for bad online reviews or purely reputational damage.
When can eSafety help with something posted on my site?
For serious online abuse that meets the legal definition, such as cyber abuse aimed at an adult. For adult cyber abuse, the content must be reported to the website or platform first, and eSafety will ask for proof of that report. If a report comes to you, act on it quickly and keep a record.
Does South Australia have the new defence for website hosts?
No. The national Stage 2 defamation reforms proposed new exemptions and a defence for digital intermediaries. South Australia's 2025 amendments, in force from 15 December 2025, left those out, though SA courts can now order a digital intermediary that isn't a party to the case to remove or block defamatory material. Separately, since earlier reforms a person suing for defamation must show serious harm to their reputation, and must send a concerns notice before starting proceedings.
Will the Digital Duty of Care cover comments and reviews on my website?
Possibly. The bill is proposed, not law. As introduced, it has no small business exemption, and websites where visitors can post, upload or review are the features most likely to matter. Our Digital Duty of Care for small business guide explains where it stands.
How WaTo can help with this
Guides on this topic
- Does the Digital Duty of Care apply to my small business?
- Digital Duty of Care risk assessment: what to include
- Is my website safe?
Sources & references
- High Court of Australia: Fairfax Media Publications Pty Ltd v Voller [2021] HCA 27 (judgment, 8 September 2021)
- South Australian Legislation: Defamation Act 2005 (version 15.12.2025)
- HWL Ebsworth: South Australia implements several Stage 2 defamation reforms
- ACCC: Online reviews for products and services
- eSafety Commissioner: How to report adult cyber abuse
- Department of Infrastructure: Digital Duty of Care
WaTo Consulting. Last reviewed 2026-11-13. Review after the Senate vote on the Digital Duty of Care Bill, when South Australia changes its Defamation Act, and when the ACCC or eSafety update their guidance.
Not sure what visitors can post on your site?
Book a call and we'll find every comment box, review widget and upload form, then set up moderation for the ones you keep.
Mon to Fri, 8:30am to 5pm
